The first 60 minutes of crisis management determine whether a problem remains a technical incident or escalates into nationwide coordination. With the head of the central and monitoring center of MV SR, Adam Regec, we covered how the state assesses the severity of cyber events, what role automation plays, and what happens when communication networks fail.
Playbooks versus People
The first 15 minutes are a very short time, so automated playbooks and monitoring systems must step in to support operators' decision-making. They help quickly recognize the severity of the incident and take the first operational steps. As the situation becomes more complicated, the human factor takes the lead, because every crisis has its specifics. Exercises repeatedly show that the hardest thing is making decisions with incomplete data and uncertainty.
Communication, Coordination and Warning
If a communication network or means is compromised, it is isolated and a backup channel is used. The Ministry of the Interior has its own Sytno radio network at its disposal and is also considering the alternative of reinforcing communication channels with satellite solutions. So far, a scenario of a complete outage of primary networks has not been necessary, but the principle is to have multiple options that can be deployed quickly. This keeps the crisis team connected even in a rapidly changing situation.
In the event of a sharp escalation, the Minister of the Interior is informed, who can convene a departmental or central crisis team and launch nationwide coordination. The public will, if necessary, be warned by the SK Alert early warning system, which uses Cell Broadcast technology to deliver messages to mobile phones in the affected area. During preparations in "peace," however, the state must strictly comply with sectoral and departmental regulations, which is administratively demanding and calls for improvements. International information sharing on incidents is being built up continuously, and there is room for progress here as well.
